@blotout/qinto-cli 0.1.18 → 0.1.20

package/dist/worker-artifact/README.md

@@ -1,3 +1,3 @@
 # Worker artifact
 
-Generated by the "Release worker" action, or locally by `pnpm --filter @qinto/worker artifact` — do not edit.
+Generated only by the "Release worker" action — never build it locally, and do not edit.

package/dist/worker-artifact/app-runtime/index.js

@@ -18959,7 +18959,7 @@ var uniqueOrIssue = (ctx, values, path, label) => {
     seen.add(value);
   }
 };
-var PLATFORM_ZONES = ["blotout.io", "qinto.tech"];
+var PLATFORM_ZONES = ["platform.blotout.io", "qinto-api.blotout.io", "appui.blotout.io", "mcp.blotout.io", "qinto.tech"];
 var isPlatformHost = (host) => {
   return PLATFORM_ZONES.some((zone) => host === zone || host.endsWith(`.${zone}`));
 };
@@ -19528,10 +19528,13 @@ var variableSchema = external_exports.object({
   label: external_exports.string().min(1).max(100),
   required: external_exports.boolean().optional(),
   browser: external_exports.boolean().optional(),
+  owner: external_exports.enum(["site", "developer"]).optional(),
   helpText: external_exports.string().min(1).max(MAX_VARIABLE_HELP_TEXT).optional(),
   helpUrl: httpsUrl("helpUrl").optional()
 }).strict().refine((variable) => !(variable.kind === "secret" && variable.browser === true), {
   message: "A secret variable can never be browser-exposed"
+}).refine((variable) => !(variable.required === true && variable.owner === "developer"), {
+  message: "A developer-owned variable cannot be required"
 });
 var appVariableSchema = external_exports.object({
   name: external_exports.string().min(1).max(64).regex(VARIABLE_NAME),
@@ -19994,6 +19997,7 @@ var MAX_PUSHES_PER_INSTALL = 10;
 var MAX_CAPTURE_WRITES_PER_INSTALL = 10;
 var CONTEXT_LEVELS = ["private", "shared"];
 var PUSH_BROADCASTS = ["install", "app", "site"];
+var ACTION_SOURCES = ["website", "api", "app", "scheduled", "webhook", "tool", "workflow"];
 var MAX_PRIVATE_CONTEXT_ENTRY_BYTES = 32 * 1024;
 var MAX_SHARED_CONTEXT_ENTRY_BYTES = 4 * 1024;
 var MAX_PUSH_BYTES = 16 * 1024;
@@ -20069,6 +20073,9 @@ var envelopeRequestSchema = external_exports.object({
     userId: external_exports.string().min(1).max(64),
     payload: external_exports.record(external_exports.string(), external_exports.unknown()),
     receivedAt: external_exports.number().int(),
+    // Optional on the wire: an app worker redeploys before its site worker, so this reader must
+    // accept an envelope a site worker predating the field produces.
+    source: external_exports.enum(ACTION_SOURCES).optional(),
     context: actionContextSchema.optional(),
     browser: external_exports.record(external_exports.string().min(1).max(64), external_exports.unknown()).optional(),
     origin: external_exports.object({ app: external_exports.string().min(1).max(30), install: external_exports.number().int().min(1), depth: external_exports.number().int().min(0) }).strict().optional()
@@ -20951,6 +20958,18 @@ var brokerPush = async (env, input2) => {
     data: input2.data
   });
 };
+var brokerTrack = async (env, input2) => {
+  await askBroker(env, `apps.track ${input2.event.payload["event"]}`, {
+    v: ENVELOPE_VERSION,
+    kind: "track",
+    slug: callerSlug(env),
+    key: env.QINTO_INTERNAL_KEY,
+    source: input2.source,
+    userId: input2.userId,
+    installId: input2.installId,
+    event: input2.event
+  });
+};
 var brokerContextRead = async (env, userId) => {
   const answer = await askBroker(env, "apps.context read", {
     v: ENVELOPE_VERSION,
@@ -21065,6 +21084,18 @@ var buildAppsClient = (env, envelope) => {
   };
 };
 
+// src/emitted-event.ts
+var checkEmittedEvent = (event) => {
+  if (event.type !== "track") {
+    throw new Error("only track events may be emitted");
+  }
+  const occurredAt = event.occurredAt ?? Date.now();
+  if (!Number.isSafeInteger(occurredAt) || occurredAt < 0) {
+    throw new Error("an emitted event occurredAt must be non-negative Unix milliseconds");
+  }
+  return { ...event, occurredAt };
+};
+
 // src/oauth.ts
 var EXPIRY_FLOOR_MS = 1e3;
 var read = (env, id, ord, now) => {
@@ -21550,6 +21581,9 @@ var buildWorkflowContext = (env, stamp) => {
         broadcast: message.broadcast
       });
     },
+    track: async (userId, event) => {
+      await brokerTrack(env, { source: "workflow", userId, installId: install.id, event: checkEmittedEvent(event) });
+    },
     apps
   };
 };
@@ -21623,15 +21657,9 @@ var buildContext = ({
     // and the extra entry keeps it visibly over while bounding memory.
     emit: (event) => {
       requireSubject(subject, "emit");
-      if (event.type !== "track") {
-        throw new Error("only track events may be emitted");
-      }
-      const occurredAt = event.occurredAt ?? Date.now();
-      if (!Number.isSafeInteger(occurredAt) || occurredAt < 0) {
-        throw new Error("an emitted event occurredAt must be non-negative Unix milliseconds");
-      }
+      const checked = checkEmittedEvent(event);
       if (emits.length <= MAX_EMITS_PER_INSTALL) {
-        emits.push({ ...event, occurredAt });
+        emits.push(checked);
       }
     },
     push: (message) => {
@@ -21802,6 +21830,9 @@ var dispatchSchedule = async (envelope, bundle, env) => {
           broadcast: message.broadcast
         });
       },
+      track: async (userId, event2) => {
+        await brokerTrack(env, { source: "scheduled", userId, installId: install.id, event: checkEmittedEvent(event2) });
+      },
       context: (userId) => {
         return asyncContext(env, () => {
           return userId;
@@ -21919,6 +21950,9 @@ var buildContext2 = (envelope, env) => {
     identity: buildIdentity(env),
     apps: buildAppsClient(env, { depth: 0 }),
     query: buildQuery({ env, ticket: envelope.tool.queryTicket, installId: install.id }),
+    track: async (userId, event) => {
+      await brokerTrack(env, { source: "tool", userId, installId: install.id, event: checkEmittedEvent(event) });
+    },
     fail: (message) => {
       return { kind: "tool_error", message: truncate(message) };
     }
@@ -22181,6 +22215,9 @@ var buildContext3 = ({
         broadcast: message.broadcast
       });
     },
+    track: async (userId, event) => {
+      await brokerTrack(env, { source: "webhook", userId, installId: install.id, event: checkEmittedEvent(event) });
+    },
     context: (userId) => {
       return asyncContext(env, () => {
         return userId;

package/dist/worker-artifact/main/7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt

@@ -0,0 +1 @@
+(function(){var e=()=>{},t=t=>{t.config?.autoCapture?.pageLoad===!0&&t.q.push([`track`,[`PageView`],e,e])},n=class extends Error{constructor(e){super(e),this.name=`QintoError`}},r=class extends n{constructor(e){super(e),this.name=`QintoTimeoutError`}},i=(e=Date.now())=>`evt_${globalThis.crypto.randomUUID()}_${e}`,a=(e,t)=>{if(e!==void 0)return e;let n=t?.orderId;return typeof n==`string`&&n!==``?n:i()},o=[`necessary`,`functional`,`analytics`,`marketing`,`salesOfData`],s=[`then`,`ready`,`config`],c=()=>{},l=(e,t)=>(...n)=>{let r=new Promise((r,i)=>{e.q.push([t,n,r,i])});return r.catch(c),r},u=e=>{let t=e;return t._q=1,t.q=[],new Proxy(t,{get:(e,n)=>typeof n!=`string`||s.includes(n)||n in t?Reflect.get(t,n):(t[n]=l(t,n),t[n])})},d=()=>{let e=document.currentScript?.dataset.qintoGlobal;return typeof e==`string`&&e!==``?e:`qinto`},f=e=>typeof e==`object`&&!!e&&e._q===1,p=(e=`qinto`)=>{let t=globalThis;if(e in t){let n=t[e];if(!f(n))return null;let r=Array.isArray(n.q)?n:u(n);return r!==n&&Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!0,configurable:!0}),r}let n=u({});return Object.defineProperty(t,e,{value:n,writable:!0,enumerable:!0,configurable:!0}),n},m=(e,t)=>async(r,i)=>{let a=Reflect.get(e,r);if(typeof a!=`function`)throw new n(`[Qinto] ${t}.${r} is not a method of this tag.`);return a.apply(e,Array.from(i))},h=e=>()=>Promise.reject(e),g=(e,t)=>{let[n,r,i,a]=t;e(n,r).then(i,a)},ee=e=>{let t=[];return t.push=(...t)=>{for(let n of t)g(e,n);return 0},t},_=(e,t,n=`window.qinto`)=>{let r=e.ready;if(r!==void 0)return r;let i=e,a=e=>{let t=i.q;i.q=ee(e);for(let n of t)g(e,n)},o=t().then(e=>{a(m(e,n))},e=>{throw a(h(e)),e});return o.catch(c),i.ready=o,o},v=(e,t,n)=>n===void 0||!o.some(e=>e===n)?!1:n===`necessary`||e!==null&&e.categories[n]===!0&&e.apps[t]!==!1,y=()=>{},te=100,ne=1024,b=32768,x=(e,t,n)=>e.target.config?.consentConfiguration?.enabled!==!0||v(n,t,e.target.config?.apps?.[t]?.category),S=e=>Object.values(e.config?.apps??{}).some(e=>e.category!==`necessary`||e.capture!==void 0),C=(e,t)=>{let{app:n,install:r,topic:i,to:a}=e;return typeof n!=`string`||typeof i!=`string`||r!==void 0&&typeof r!=`string`||t&&!(Array.isArray(a)&&a.every(e=>typeof e==`string`))},re=(e,t,n,r)=>r===null?e.slug===t&&(n===void 0||n===e.installId):r.has(e.slug),w=(e,t)=>{console.error(`[Qinto] A handler of app "${e.slug}" (install "${e.installId}") failed.`,t)},T=(e,t,n)=>{for(let r of t)try{let t=r(n);t instanceof Promise&&t.catch(t=>{w(e,t)})}catch(t){w(e,t)}},ie=(e,t,n,r)=>{e.activated.add(r.id);let i={slug:t,installId:r.id,eventHandlers:[],consentHandlers:[],pushHandlers:[],sharedContextHandlers:[]};e.instances.push(i);let a={variables:r.variables,install:{id:r.id,label:r.label},getSession:async()=>{let n=await e.client.getSession();return e.target.config?.apps?.[t]?.geo===!0?n:{...n,ip:null,geo:null}},track:(t,n)=>{e.client.track(t,n).catch(y)},onEvent:e=>{i.eventHandlers.push(e)},onConsent:e=>{i.consentHandlers.push(e)},onPush:e=>{i.pushHandlers.push(e)},fetch:async(n,i)=>{let a=new URL(`${e.client.destination}/app/${t}${n}`);if(!n.startsWith(`/`)||!a.pathname.startsWith(`/app/${t}/`))throw TypeError(`[Qinto] App "${t}" fetched "${n}"; the path must be absolute and stay inside the app.`);let o=new Headers(i?.headers);return o.set(`x-qinto-install`,r.id),fetch(a,{...i,headers:o,credentials:`include`})},onSharedContext:n=>{if(e.target.config?.apps?.[t]?.sharedContext!==!0){console.error(`[Qinto] App "${t}" reads shared context without declaring the sharedContext capability.`);return}i.sharedContextHandlers.push(n),e.sharedContext!==null&&ae(e,t)&&T(i,[n],e.sharedContext)}};try{n(a)}catch(e){console.error(`[Qinto] App "${t}" failed to activate install "${r.id}".`,e)}},E=(e,t,n)=>{if(!x(e,t,e.consent))return;let r=((`_appInstalls`in e.target?e.target._appInstalls:void 0)?.[t]??[]).filter(t=>!e.activated.has(t.id));if(r.length===0)return;let i=n.factory;if(i===void 0){try{i=n.loader()}catch(e){i=null,console.error(`[Qinto] App "${t}" failed to load.`,e)}e.apps.set(t,{...n,factory:i})}if(i!==null)for(let n of r)ie(e,t,i,n)},ae=(e,t)=>x(e,t,e.consent)?e.sharedContextConsent===void 0||x(e,t,e.sharedContextConsent):!1,D=e=>{let{categories:t,apps:n}=e;if(typeof t==`object`&&t&&typeof n==`object`&&n)return{categories:t,apps:n}},O=(e,t)=>{let n=e;n.consent=t,n.sharedContextConsent=void 0;for(let n of e.instances)T(n,n.consentHandlers,t);e.onConsentSettled?.(t);for(let[t,n]of e.apps)E(e,t,n)},k=async e=>{try{O(e,await e.client.getConsent())}catch(e){console.error(`[Qinto] The apps consent read failed.`,e)}},A=e=>{let t;try{t=JSON.stringify(e)}catch{return}if(!(t===void 0||new TextEncoder().encode(t).length>ne))return JSON.parse(t)},j=e=>{let t={};for(let n of e){if(n.settled!==n.total||n.values.length!==1)continue;let e=A(n.values[0]);if(e===void 0)continue;let r={...t[n.instance.slug]??{},[n.instance.installId]:e},i={...t,[n.instance.slug]:r};new TextEncoder().encode(JSON.stringify(i)).length<=b&&(t[n.instance.slug]=r)}return Object.keys(t).length===0?void 0:t},M=async(e,t)=>{e.onPageEvent?.(e.consent);let n=[],r=[];for(let i of e.instances){if(!x(e,i.slug,e.consent))continue;if(e.target.config?.apps?.[i.slug]?.eventResults?.includes(t.type)!==!0){T(i,i.eventHandlers,t);continue}let a={instance:i,total:i.eventHandlers.length,settled:0,values:[]};n.push(a);for(let e of i.eventHandlers){let n;try{n=e(t)}catch(e){a.settled+=1,w(i,e);continue}r.push(Promise.resolve(n).then(e=>{a.settled+=1,e!==void 0&&a.values.push(e)},e=>{a.settled+=1,w(i,e)}))}}if(r.length>0){let e=y,t=new Promise(t=>{e=t}),n=setTimeout(e,te);await Promise.race([Promise.all(r),t]),clearTimeout(n)}return j(n)},N=e=>{let{client:t}=e;return{track:async(n,r,i)=>{let o=a(i?.eventId,r),s=t.actionContext(),c=await M(e,{type:`track`,event:n,eventId:o,properties:r??{}});return await t.submitTrack({event:n,eventId:o,properties:r,context:s,appResults:c}),{eventId:o}},identify:async(n,r)=>{let i=t.actionContext(),a=await M(e,{type:`identify`,event:`identify`,properties:n??{}});return t.submitIdentify({traits:n,id:r,context:i,appResults:a})},alias:t.alias,consent:async n=>{if(await t.submitConsent(n,t.actionContext()),e.onConsentMutation?.(),S(e.target)){let t=e;t.consent=null,await k(e)}},getAnonId:t.getAnonId,getConsent:t.getConsent,getSession:t.getSession,close:t.close}},P=(e,t)=>{let n=new Map,r=null,i=null,a=e=>{let[t,i]=e;if(n.has(t))return;let a={loader:i};n.set(t,a),r?.(t,a)},o=e,s=`_apps`in o?o._apps:void 0,c=Array.isArray(s)?s:[];c.push=(...e)=>{for(let t of e)a(t);return 0},o._apps=c;for(let e of c.splice(0))a(e);return{sharedContext:e=>{let{context:t}=e;if(typeof t!=`object`||!t||Array.isArray(t)){console.error(`[Qinto] The server sent a malformed shared context.`,e);return}let n=i;if(n===null)return;n.sharedContext=t;let r=D(e),a=r??n.consent;n.sharedContextConsent=r;for(let e of n.instances)x(n,e.slug,a)&&T(e,e.sharedContextHandlers,n.sharedContext)},push:e=>{let{app:t,install:n,topic:r,scope:a,to:o}=e,s=a===`site`;if(C(e,s)){console.error(`[Qinto] The server sent a malformed app push.`,e);return}let c=i;if(c===null)return;let l=s?new Set(o):null,u={topic:r,data:e.data,from:t};for(let e of c.instances)re(e,t,n,l)&&x(c,e.slug,c.consent)&&T(e,e.pushHandlers,u)},connect:async a=>{let o={target:e,client:a,apps:n,instances:[],activated:new Set,consent:null,sharedContext:i?.sharedContext??null,sharedContextConsent:i?.sharedContextConsent,onConsentSettled:t?.onConsentSettled,onConsentMutation:t?.onConsentMutation,onPageEvent:t?.onPageEvent};i=o,r=(e,t)=>{E(o,e,t),o.consent===null&&o.target.config?.consentConfiguration?.enabled===!0&&o.target.config?.apps?.[e]?.category!==`necessary`&&k(o)};for(let[e,t]of n)E(o,e,t);return e.config?.consentConfiguration?.enabled===!0&&S(e)?await k(o):o.onConsentSettled?.(o.consent),N(o)}}},F=512,I=864e5,L=e=>Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Object.fromEntries(Object.entries(t).map(([e,t])=>[e,t.value]))])),R=(e,t)=>`qinto:cap:${encodeURIComponent(e)}:${encodeURIComponent(t)}`,z=e=>{try{let t=window.sessionStorage.getItem(e);if(t===null)return null;let n=JSON.parse(t);return typeof n.at!=`number`||typeof n.anonId!=`string`||typeof n.apps!=`object`||n.apps===null||Date.now()-n.at>I?null:{at:n.at,anonId:n.anonId,apps:n.apps}}catch{return null}},B=(e,t)=>{try{window.sessionStorage.setItem(e,JSON.stringify(t))}catch{}},V=e=>{try{window.sessionStorage.removeItem(e)}catch{}},H=e=>{try{return decodeURIComponent(e)}catch{return e}},U=()=>{let e={};for(let t of document.cookie.split(`;`)){let n=t.indexOf(`=`);n>0&&(e[t.slice(0,n).trim()]=H(t.slice(n+1)))}return e},W=(e,t)=>{let n={};for(let r of e.queryParams){let e=t.params.get(r);e!==null&&e.length<=F&&(n[r]={value:e,source:`query`})}for(let r of e.cookies){let e=t.cookies[r];e!==void 0&&e.length<=F&&(n[r]={value:e,source:`cookie`})}return n},G=(e,t)=>{let n={params:new URLSearchParams(window.location.search),cookies:U()},r={};for(let[i,a]of Object.entries(e.config?.apps??{})){if(a.capture===void 0||!v(t,i,a.category))continue;let e=W(a.capture,n);Object.keys(e).length>0&&(r[i]=e)}return r},K=(e,t)=>{let n={};for(let[r,i]of Object.entries(e)){let e=t[r]??{},a={};for(let[t,n]of Object.entries(i))(e[t]?.value!==n.value||e[t]?.source!==n.source)&&(a[t]=n);Object.keys(a).length>0&&(n[r]=a)}return n},oe=(e,t,n,r)=>{let i=R(r,n),a=z(i),o=a?.apps??{},s=a?.anonId??null,c=a===null,l={},u=0,d=(e,t)=>{s!==null&&s!==e.anonId&&(o={}),s=e.anonId;let n=new Set(Object.entries(e.accepted).flatMap(([e,t])=>t.map(t=>`${e}\u0000${t}`)));for(let[e,r]of Object.entries(t))for(let[t,i]of Object.entries(r))n.has(`${e}\u0000${t}`)&&(o[e]={...o[e],[t]:i});B(i,{at:Date.now(),anonId:s,apps:o})},f=null,p=()=>{u+=1,o={},l={},V(i)},m=n=>{if(f=n,!c)return;let r=K(G(e,n),{...o,...l});if(Object.keys(r).length===0)return;let i=u;l={...l,...r},t(L(r)).then(e=>{i===u&&d(e,r)}).catch(()=>{}).finally(()=>{l={}})};return{settled:e=>{m(e)},needsAnon:()=>!c,observedAnon:e=>{(e===null||s!==null&&s!==e)&&p(),s=e,c=!0,m(f)},clear:p}},q=Symbol.for(`qinto.connectGate`),J=()=>{},se=e=>{let t=globalThis,n=(t[q]??Promise.resolve()).then(e);return t[q]=n.then(J,J),n},Y=class extends n{constructor(e){super(e),this.name=`QintoProtocolError`}},ce=e=>{if(typeof e!=`string`)return null;let t;try{t=JSON.parse(e)}catch{return null}if(typeof t!=`object`||!t)return null;let n=t;return n.t===`ack`||n.t===`error`||n.t===`consentState`||n.t===`session`||n.t===`captureAck`||n.t===`appPush`||n.t===`sharedContext`?t:null},le=e=>{if(e.t===`consentState`)return{categories:e.categories,apps:e.apps};if(e.t===`session`)return{anonId:e.anonId,globalId:e.globalId,ip:e.ip,geo:e.geo};if(e.t===`captureAck`)return{anonId:e.anonId,accepted:e.accepted}},ue=e=>{let t=new Map,n=e=>{let n=t.get(e);if(n!==void 0)return clearTimeout(n.timer),t.delete(e),n};return{submit:n=>new Promise((i,a)=>{let o={frame:n,sent:e.send(n),resolve:i,reject:a,timer:setTimeout(()=>{t.delete(n.ref),a(new r(`The Qinto request timed out.`))},e.requestTimeoutMs)};t.set(n.ref,o)}),flush:()=>{for(let n of t.values())n.sent||=e.send(n.frame)},deliver:e=>{let t=e.ref===void 0?void 0:n(e.ref);if(t!==void 0){if(e.t===`error`){t.reject(new Y(e.message));return}t.resolve(le(e))}},rejectAll:e=>{let n=[...t.values()];t.clear();for(let t of n)clearTimeout(t.timer),t.reject(e)}}},de=e=>new WebSocket(e),fe=500,pe=3e4,me=`session not initialized`,he=(e,t)=>{let n=Math.min(fe*2**e,pe);return Math.round(n/2+n/2*t)},ge=(e,t)=>e.t===`appPush`?(t.onAppPush?.(e),!0):e.t===`sharedContext`&&(t.onSharedContext?.(e),!0),X=e=>{let t=`${e.destination.replace(/\/+$/,``)}/open`,n=null,r=null,i=0,a=null,o=ue({send:e=>n===null||n.readyState!==1?!1:(n.send(JSON.stringify(e)),!0),requestTimeoutMs:e.requestTimeoutMs}),s=t=>{e.onError?.(t)},c=()=>{if(r!==null&&(clearTimeout(r),r=null),n!==null){let e=n;n=null,e.close()}o.rejectAll(new Y(`connection closed`))},l=()=>{let u=de(t);n=u,u.onopen=()=>{i=0;let e=a;a=null,o.flush(),e?.resolve()},u.onmessage=t=>{let n=ce(t.data);if(n===null){s(new Y(`invalid message`));return}ge(n,e)||(`anonId`in n&&typeof n.anonId==`string`&&e.onAnonId?.(n.anonId),o.deliver(n),n.t===`error`&&n.message===me&&u.close())},u.onerror=()=>{s(new Y(`connection closed`))},u.onclose=()=>{if(n!==u)return;n=null;let e=a;if(e!==null){a=null,c(),e.reject(new Y(`connection closed`));return}o.rejectAll(new Y(`connection closed`)),r=setTimeout(()=>{r=null,l()},he(i,Math.random())),i+=1}};return{connect:()=>new Promise((e,t)=>{a={resolve:e,reject:t},l()}),submit:e=>o.submit(e),close:()=>{c()}}},_e=1e4,ve=()=>{let e=0;return()=>(e+=1,`q${e}`)},ye=(e,t,n)=>{let r=null,i=()=>{let e=document.referrer;return{occurredAt:Date.now(),page:{url:window.location.href,...e===``?{}:{referrer:e}}}},o=async()=>{let n=await e.submit({t:`getSession`,ref:t()});return r=n.anonId,n};return{destination:n.replace(/\/+$/,``),actionContext:i,submitIdentify:async({traits:n,id:r,context:i,appResults:a})=>{await e.submit({t:`identify`,ref:t(),traits:n,id:r,context:i,appResults:a})},submitTrack:async({event:n,eventId:r,properties:i,context:a,appResults:o})=>{await e.submit({t:`track`,ref:t(),event:n,eventId:r,properties:i,context:a,appResults:o})},submitConsent:async(n,r)=>{await e.submit({t:`consent`,ref:t(),categories:n.categories,apps:n.apps,context:r})},track:async(n,r,o)=>{let s=a(o?.eventId,r);return await e.submit({t:`track`,ref:t(),event:n,eventId:s,properties:r,context:i()}),{eventId:s}},alias:async n=>{await e.submit({t:`alias`,ref:t(),alias:n})},getConsent:async()=>await e.submit({t:`getConsent`,ref:t()}),getSession:o,getAnonId:async()=>(r===null&&await o(),r),close:async()=>{e.close()}}},be=async e=>{let t=X({destination:e.destination,requestTimeoutMs:e.requestTimeoutMs??_e,onError:e.onError,onAppPush:e.onAppPush,onSharedContext:e.onSharedContext,onAnonId:e.onAnonId});await se(()=>t.connect());let n=ve();return{client:ye(t,n,e.destination),submitCapture:async e=>await t.submit({t:`capture`,ref:n(),apps:e})}},xe=(e,t)=>{let n=null,r=P(e,{onConsentSettled:e=>{n?.settled(e)},onConsentMutation:()=>{n?.clear()},onPageEvent:e=>{n?.settled(e)}});return{connect:async i=>{let a=await be({...i,onAppPush:r.push,onSharedContext:r.sharedContext,onAnonId:e=>{n?.observedAnon(e)}});n=oe(e,a.submitCapture,i.destination,t);let o=await r.connect(a.client);return n.needsAnon()&&n.observedAnon((await a.client.getSession()).anonId),o}}},Z=d(),Q=p(Z),$=`window.${Z}`;if(Q!==null&&Q.ready===void 0){let e=xe(Q,Z);t(Q),_(Q,async()=>{let t=Q.config?.destination;if(typeof t!=`string`||t===``)throw Error(`[Qinto] ${$}.config.destination is missing.`);return e.connect({destination:t})},$)}})();

package/dist/worker-artifact/main/index.js

@@ -20360,7 +20360,7 @@ var uniqueOrIssue = /* @__PURE__ */ __name((ctx, values, path, label) => {
     seen.add(value);
   }
 }, "uniqueOrIssue");
-var PLATFORM_ZONES = ["blotout.io", "qinto.tech"];
+var PLATFORM_ZONES = ["platform.blotout.io", "qinto-api.blotout.io", "appui.blotout.io", "mcp.blotout.io", "qinto.tech"];
 var isPlatformHost = /* @__PURE__ */ __name((host) => {
   return PLATFORM_ZONES.some((zone) => host === zone || host.endsWith(`.${zone}`));
 }, "isPlatformHost");
@@ -20992,10 +20992,13 @@ var variableSchema = external_exports.object({
   label: external_exports.string().min(1).max(100),
   required: external_exports.boolean().optional(),
   browser: external_exports.boolean().optional(),
+  owner: external_exports.enum(["site", "developer"]).optional(),
   helpText: external_exports.string().min(1).max(MAX_VARIABLE_HELP_TEXT).optional(),
   helpUrl: httpsUrl("helpUrl").optional()
 }).strict().refine((variable) => !(variable.kind === "secret" && variable.browser === true), {
   message: "A secret variable can never be browser-exposed"
+}).refine((variable) => !(variable.required === true && variable.owner === "developer"), {
+  message: "A developer-owned variable cannot be required"
 });
 var appVariableSchema = external_exports.object({
   name: external_exports.string().min(1).max(64).regex(VARIABLE_NAME),
@@ -21467,6 +21470,8 @@ var MAX_CAPTURE_WRITES_PER_INSTALL = 10;
 var MAX_CONTEXT_WRITES_PER_INSTALL = 2;
 var CONTEXT_LEVELS = ["private", "shared"];
 var PUSH_BROADCASTS = ["install", "app", "site"];
+var ACTION_SOURCES = ["website", "api", "app", "scheduled", "webhook", "tool", "workflow"];
+var APP_HANDLER_SOURCES = ["scheduled", "webhook", "tool", "workflow"];
 var MAX_PRIVATE_CONTEXT_ENTRY_BYTES = 32 * 1024;
 var MAX_SHARED_CONTEXT_ENTRY_BYTES = 4 * 1024;
 var MAX_PUSH_BYTES = 16 * 1024;
@@ -21542,6 +21547,9 @@ var envelopeRequestSchema = external_exports.object({
     userId: external_exports.string().min(1).max(64),
     payload: external_exports.record(external_exports.string(), external_exports.unknown()),
     receivedAt: external_exports.number().int(),
+    // Optional on the wire: an app worker redeploys before its site worker, so this reader must
+    // accept an envelope a site worker predating the field produces.
+    source: external_exports.enum(ACTION_SOURCES).optional(),
     context: actionContextSchema.optional(),
     browser: external_exports.record(external_exports.string().min(1).max(64), external_exports.unknown()).optional(),
     origin: external_exports.object({ app: external_exports.string().min(1).max(30), install: external_exports.number().int().min(1), depth: external_exports.number().int().min(0) }).strict().optional()
@@ -26868,7 +26876,6 @@ var submitAction = /* @__PURE__ */ __name(async (env, userId, args, request) =>
       ...args,
       userId: resolved.id,
       identifier: resolved.identifier,
-      source: "http",
       receivedAt,
       context: serverActionContext(args.context, receivedAt),
       geo: request?.cf,
@@ -27159,6 +27166,90 @@ var lookupPersonForApp = /* @__PURE__ */ __name(async (env, slug, id, afterRowId
   return page === null ? null : personOf(globalId, page);
 }, "lookupPersonForApp");
 
+// src/apps/broker-fields.ts
+var identityFields = {
+  // Derived, never a literal: the client stamps ENVELOPE_VERSION on every body, so a hardcoded
+  // number here silently 400s the whole channel the next time the envelope version moves.
+  v: external_exports.literal(ENVELOPE_VERSION),
+  slug: external_exports.string().min(1).max(30),
+  key: external_exports.string().min(1)
+};
+
+// src/apps/emit-payload.ts
+var emitPayloadSchema = external_exports.object({
+  event: external_exports.string().min(1),
+  eventId: external_exports.string().min(1).optional(),
+  properties: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).strict();
+var emittedEventId = /* @__PURE__ */ __name((eventId, properties2) => {
+  if (eventId !== void 0) {
+    return eventId;
+  }
+  const orderId = properties2?.["orderId"];
+  if (typeof orderId === "string" && orderId !== "") {
+    return orderId;
+  }
+  return `evt_${ulid3()}`;
+}, "emittedEventId");
+
+// src/apps/rate-limit.ts
+var limiterAbsenceLogged = false;
+var rateLimited = /* @__PURE__ */ __name(async (env, key, binding = "BROKER_RATE_LIMITER") => {
+  const limiter = env[binding];
+  if (limiter === void 0) {
+    if (!limiterAbsenceLogged) {
+      limiterAbsenceLogged = true;
+      addSpanEvent("rate limiter binding is absent; limits are off", { level: "warn", attrs: { binding } });
+    }
+    return false;
+  }
+  const outcome = await limiter.limit({ key });
+  return !outcome.success;
+}, "rateLimited");
+
+// src/apps/broker-track.ts
+var trackBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("track"),
+  source: external_exports.enum(APP_HANDLER_SOURCES),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64),
+  event: emitSchema
+}).strict();
+var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  if (!app2.installs.some((install) => install.active && install.id === body.installId)) {
+    return Response.json({ error: "invalid_install" }, { status: 400 });
+  }
+  const parsed = emitPayloadSchema.safeParse(body.event.payload);
+  if (!parsed.success) {
+    return Response.json({ error: "invalid_event" }, { status: 400 });
+  }
+  if (!isCanonicalId(body.userId)) {
+    return Response.json({ error: "invalid_user" }, { status: 400 });
+  }
+  if (await rateLimited(env, `${body.slug}:${body.installId}:track`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const site = ownSite(env);
+  if (!await anonStub(env, body.userId).appAllowed(body.slug, site, currentTraceContext())) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const { event, eventId, properties: properties2 } = parsed.data;
+  const action = buildAction({
+    type: "track",
+    userId: body.userId,
+    source: body.source,
+    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
+    context: { source: "app", occurredAt: body.event.occurredAt, offline: false, replay: false }
+  });
+  await ingest(env, action, site);
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handleTrack");
+
 // src/id-graph/anon/context.ts
 var LEVEL_KINDS = {
   private: { kv: "context_private_kv", text: "context_private_text" },
@@ -27596,6 +27687,7 @@ var eventAction = /* @__PURE__ */ __name((target, trigger, snapshot) => {
     userId: snapshot.anonId,
     payload: trigger.action.payload,
     receivedAt: trigger.action.receivedAt,
+    source: trigger.action.source,
     ...buckets.includes("eventContext") && trigger.action.context !== void 0 ? { context: trigger.action.context } : {},
     ...trigger.action.browserResults?.[target.slug] === void 0 ? {} : { browser: trigger.action.browserResults[target.slug] },
     ...trigger.action.origin !== void 0 ? { origin: trigger.action.origin } : {}
@@ -27633,21 +27725,6 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
     ...trigger.kind === "event" ? { action: eventAction(target, trigger, snapshot) } : {}
   };
 }, "buildEnvelope");
-var emitPayloadSchema = external_exports.object({
-  event: external_exports.string().min(1),
-  eventId: external_exports.string().min(1).optional(),
-  properties: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}).strict();
-var emittedEventId = /* @__PURE__ */ __name((eventId, properties2) => {
-  if (eventId !== void 0) {
-    return eventId;
-  }
-  const orderId = properties2?.["orderId"];
-  if (typeof orderId === "string" && orderId !== "") {
-    return orderId;
-  }
-  return `evt_${ulid3()}`;
-}, "emittedEventId");
 var ingestEmit = /* @__PURE__ */ __name(async (ingest2, { slug, ord, depth, emit, anonId, geo, host, context }) => {
   const parsed = emitPayloadSchema.safeParse(emit.payload);
   if (!parsed.success) {
@@ -27826,31 +27903,9 @@ var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
   );
 }, "invokeApp");
 
-// src/apps/rate-limit.ts
-var limiterAbsenceLogged = false;
-var rateLimited = /* @__PURE__ */ __name(async (env, key, binding = "BROKER_RATE_LIMITER") => {
-  const limiter = env[binding];
-  if (limiter === void 0) {
-    if (!limiterAbsenceLogged) {
-      limiterAbsenceLogged = true;
-      addSpanEvent("rate limiter binding is absent; limits are off", { level: "warn", attrs: { binding } });
-    }
-    return false;
-  }
-  const outcome = await limiter.limit({ key });
-  return !outcome.success;
-}, "rateLimited");
-
 // src/apps/broker.ts
 var MAX_RPC_DEPTH = 3;
 var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
-var identityFields = {
-  // Derived, never a literal: the client stamps ENVELOPE_VERSION on every body, so a hardcoded
-  // number here silently 400s the whole channel the next time the envelope version moves.
-  v: external_exports.literal(ENVELOPE_VERSION),
-  slug: external_exports.string().min(1).max(30),
-  key: external_exports.string().min(1)
-};
 var pushBody = external_exports.object({
   ...identityFields,
   kind: external_exports.literal("push"),
@@ -27920,7 +27975,8 @@ var brokerBody = external_exports.discriminatedUnion("kind", [
   contextReadBody,
   contextWriteBody,
   factsReadBody,
-  identityReadBody
+  identityReadBody,
+  trackBody
 ]);
 var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
 var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
@@ -28307,6 +28363,9 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
     case "identityRead": {
       return handleIdentityRead(env, body);
     }
+    case "track": {
+      return handleTrack(env, body);
+    }
   }
 }, "handleBroker");
 var brokerRoutes = new Hono2();
@@ -28749,6 +28808,7 @@ var requireScope = /* @__PURE__ */ __name((bit) => {
     if ((entry.mask & bit) === 0) {
       return c.json({ error: "forbidden" }, 403);
     }
+    c.set("actionSource", entry.app === null ? "api" : "app");
     return next();
   };
 }, "requireScope");
@@ -30461,14 +30521,14 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.6",
-  gitSha: "c1c5efdcdd94c4d8871c27924e1941be3444effe",
-  builtAt: "2026-09-08T14:30:58.153Z",
-  hash: "2a40c5a8fc3a17ea4eaeb819842f609694ccaddd1fc563c95463cc92bd6690df"
+  version: "0.1.10",
+  gitSha: "f21182929c88fa0748f575164bde781b31f4fbdd",
+  builtAt: "2026-09-23T15:34:39.048Z",
+  hash: "d1804e7914363626fed0280696cad5e06728b899e23c8a5ee6dcced3b67cf831"
 };
 
 // src/paths/q-js.ts
-import qScript from "./b6b625dbf1615da405354d9b8813ffcc4e753b93-q.js.txt";
+import qScript from "./7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -30599,7 +30659,12 @@ var definition2 = createRoute({
 });
 var alias = createApiRouter().openapi(definition2, async (c) => {
   const body = c.req.valid("json");
-  const id = await submitAction(c.env, body.identifier, { type: "alias", payload: { alias: body.alias } }, c.req.raw);
+  const id = await submitAction(
+    c.env,
+    body.identifier,
+    { type: "alias", source: c.get("actionSource"), payload: { alias: body.alias } },
+    c.req.raw
+  );
   return respond(c, acceptedResponse, { ok: true, id });
 });
 
@@ -30701,7 +30766,7 @@ var consent = createApiRouter().openapi(definition4, async (c) => {
   const id = await submitAction(
     c.env,
     identifier,
-    { type: "consent", payload: { categories: categories ?? {}, apps: apps ?? {} }, context },
+    { type: "consent", source: c.get("actionSource"), payload: { categories: categories ?? {}, apps: apps ?? {} }, context },
     c.req.raw
   );
   return respond(c, acceptedResponse, { ok: true, id });
@@ -30800,7 +30865,12 @@ var definition6 = createRoute({
 });
 var identify = createApiRouter().openapi(definition6, async (c) => {
   const { identifier, traits, context } = c.req.valid("json");
-  const id = await submitAction(c.env, identifier, { type: "identify", payload: { traits: traits ?? {} }, context }, c.req.raw);
+  const id = await submitAction(
+    c.env,
+    identifier,
+    { type: "identify", source: c.get("actionSource"), payload: { traits: traits ?? {} }, context },
+    c.req.raw
+  );
   return respond(c, acceptedResponse, { ok: true, id });
 });
 
@@ -30950,7 +31020,7 @@ var session = createApiRouter().openapi(definition9, async (c) => {
 });
 
 // src/paths/v1/track.ts
-var trackBody = external_exports.object({
+var trackBody2 = external_exports.object({
   identifier: identifierField2,
   event: external_exports.string().min(1).openapi({
     description: "Name of the event the user performed.",
@@ -30982,7 +31052,7 @@ var definition10 = createRoute({
     body: {
       required: true,
       description: "The event to record.",
-      content: { "application/json": { schema: trackBody } }
+      content: { "application/json": { schema: trackBody2 } }
     }
   },
   responses: {
@@ -30999,7 +31069,7 @@ var track = createApiRouter().openapi(definition10, async (c) => {
     const id = await submitAction(
       c.env,
       identifier,
-      { type: "track", payload: { event, eventId, properties: properties2 ?? {} }, context },
+      { type: "track", source: c.get("actionSource"), payload: { event, eventId, properties: properties2 ?? {} }, context },
       c.req.raw
     );
     return respond(c, acceptedResponse, { ok: true, id });
@@ -31111,6 +31181,13 @@ var FanOut = class extends WorkerEntrypoint2 {
 // src/apps/storage-link-site.ts
 import { WorkerEntrypoint as WorkerEntrypoint3 } from "cloudflare:workers";
 
+// src/apps/action-source.ts
+var LEGACY_SOURCES = { ws: "website", http: "api" };
+var withCurrentSource = /* @__PURE__ */ __name((action) => {
+  const current = LEGACY_SOURCES[action.source];
+  return current === void 0 ? action : { ...action, source: current };
+}, "withCurrentSource");
+
 // src/apps/transform.ts
 var TRANSFORM_TIMEOUT_MS = 500;
 var TRANSFORM_CHAIN_BUDGET_MS = 1e3;
@@ -31312,10 +31389,11 @@ var StorageLinkSite = class extends WorkerEntrypoint3 {
     __name(this, "StorageLinkSite");
   }
   fanOut(job) {
-    runFanOut(this.env, this.ctx, job);
+    const trigger = job.trigger.kind === "event" ? { ...job.trigger, action: withCurrentSource(job.trigger.action) } : job.trigger;
+    runFanOut(this.env, this.ctx, { ...job, trigger });
   }
   transform(input2) {
-    return runTransformChain(this.env, { ...input2, dataPoints: createDataPointBudget() });
+    return runTransformChain(this.env, { ...input2, action: withCurrentSource(input2.action), dataPoints: createDataPointBudget() });
   }
   describe() {
     return describeSite(this.env);
@@ -32199,7 +32277,7 @@ var updateGeo = /* @__PURE__ */ __name((storage, geo, observedAt) => {
     record2[key] = { value, observedAt };
     mutated = true;
     if (GEO_SERIES_KEY_SET.has(key)) {
-      insertFact(storage.sql, { ...projectionFact(entry.key), value: entry.value, source: "ws", observedAt: entry.observedAt });
+      insertFact(storage.sql, { ...projectionFact(entry.key), value: entry.value, source: "website", observedAt: entry.observedAt });
       appended.push(entry);
     }
   }
@@ -32610,7 +32688,7 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
         type: "identify",
         userId,
         identifier,
-        source: "ws",
+        source: "website",
         payload: { traits: frame.traits ?? {} },
         context: browserActionContext(frame.context, host, session2),
         browserResults: frame.appResults,
@@ -32622,7 +32700,7 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
       return buildAction({
         type: "track",
         userId,
-        source: "ws",
+        source: "website",
         payload: { event: frame.event, eventId: frame.eventId, properties: frame.properties ?? {} },
         context: browserActionContext(frame.context, host, session2),
         browserResults: frame.appResults,
@@ -32631,13 +32709,13 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
       });
     }
     case "alias": {
-      return buildAction({ type: "alias", userId, source: "ws", payload: { alias: frame.alias }, geo, host });
+      return buildAction({ type: "alias", userId, source: "website", payload: { alias: frame.alias }, geo, host });
     }
     case "consent": {
       return buildAction({
         type: "consent",
         userId,
-        source: "ws",
+        source: "website",
         payload: { categories: frame.categories ?? {}, apps: frame.apps ?? {} },
         context: browserActionContext(frame.context, host, session2),
         geo,

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
-    "version": "0.1.2",
-    "gitSha": "3f472a5c25add00444d8766fdabc271b9b86438e",
-    "builtAt": "2026-09-23T15:32:11.643Z",
+    "version": "0.1.4",
+    "gitSha": "84a03b1ccdff814840f560c7efd0f72837454227",
+    "builtAt": "2026-09-24T14:23:50.391Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -10,8 +10,8 @@
     "mainModule": "index.js",
     "modules": [
       {
-        "name": "b6b625dbf1615da405354d9b8813ffcc4e753b93-q.js.txt",
-        "path": "main/b6b625dbf1615da405354d9b8813ffcc4e753b93-q.js.txt",
+        "name": "7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt",
+        "path": "main/7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt",
         "contentType": "text/plain"
       },
       {
@@ -39,9 +39,9 @@
     ]
   },
   "app-runtime": {
-    "version": "0.1.0",
-    "gitSha": "029b959b64dccc88a7a1f0687d5fc000a5042aba",
-    "builtAt": "2026-09-23T15:32:13.746Z",
+    "version": "0.1.2",
+    "gitSha": "5c24e6442ad668125bba59aaec084adb43b70d1d",
+    "builtAt": "2026-09-24T14:23:53.656Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {

package/dist/worker-artifact/main/b6b625dbf1615da405354d9b8813ffcc4e753b93-q.js.txt

@@ -1 +0,0 @@
-(function(){var e=()=>{},t=t=>{t.config?.autoCapture?.pageLoad===!0&&t.q.push([`track`,[`PageView`],e,e])},n=class extends Error{constructor(e){super(e),this.name=`QintoError`}},r=class extends n{constructor(e){super(e),this.name=`QintoTimeoutError`}},i=(e=Date.now())=>`evt_${globalThis.crypto.randomUUID()}_${e}`,a=(e,t)=>{if(e!==void 0)return e;let n=t?.orderId;return typeof n==`string`&&n!==``?n:i()},o=[`necessary`,`functional`,`analytics`,`marketing`,`salesOfData`],s=[`then`,`ready`,`config`],c=()=>{},l=(e,t)=>(...n)=>{let r=new Promise((r,i)=>{e.q.push([t,n,r,i])});return r.catch(c),r},u=e=>{let t=e;return t._q=1,t.q=[],new Proxy(t,{get:(e,n)=>typeof n!=`string`||s.includes(n)||n in t?Reflect.get(t,n):(t[n]=l(t,n),t[n])})},d=()=>{let e=document.currentScript?.dataset.qintoGlobal;return typeof e==`string`&&e!==``?e:`qinto`},f=e=>typeof e==`object`&&!!e&&e._q===1,p=(e=`qinto`)=>{let t=globalThis;if(e in t){let n=t[e];if(!f(n))return null;let r=Array.isArray(n.q)?n:u(n);return r!==n&&Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!0,configurable:!0}),r}let n=u({});return Object.defineProperty(t,e,{value:n,writable:!0,enumerable:!0,configurable:!0}),n},m=(e,t)=>async(r,i)=>{let a=Reflect.get(e,r);if(typeof a!=`function`)throw new n(`[Qinto] ${t}.${r} is not a method of this tag.`);return a.apply(e,Array.from(i))},h=e=>()=>Promise.reject(e),g=(e,t)=>{let[n,r,i,a]=t;e(n,r).then(i,a)},ee=e=>{let t=[];return t.push=(...t)=>{for(let n of t)g(e,n);return 0},t},_=(e,t,n=`window.qinto`)=>{let r=e.ready;if(r!==void 0)return r;let i=e,a=e=>{let t=i.q;i.q=ee(e);for(let n of t)g(e,n)},o=t().then(e=>{a(m(e,n))},e=>{throw a(h(e)),e});return o.catch(c),i.ready=o,o},v=(e,t,n)=>n===void 0||!o.some(e=>e===n)?!1:n===`necessary`||e!==null&&e.categories[n]===!0&&e.apps[t]!==!1,y=()=>{},te=100,ne=1024,b=32768,x=(e,t,n)=>e.target.config?.consentConfiguration?.enabled!==!0||v(n,t,e.target.config?.apps?.[t]?.category),S=e=>Object.values(e.config?.apps??{}).some(e=>e.category!==`necessary`||e.capture!==void 0),C=(e,t)=>{let{app:n,install:r,topic:i,to:a}=e;return typeof n!=`string`||typeof i!=`string`||r!==void 0&&typeof r!=`string`||t&&!(Array.isArray(a)&&a.every(e=>typeof e==`string`))},re=(e,t,n,r)=>r===null?e.slug===t&&(n===void 0||n===e.installId):r.has(e.slug),w=(e,t)=>{console.error(`[Qinto] A handler of app "${e.slug}" (install "${e.installId}") failed.`,t)},T=(e,t,n)=>{for(let r of t)try{let t=r(n);t instanceof Promise&&t.catch(t=>{w(e,t)})}catch(t){w(e,t)}},ie=(e,t,n,r)=>{e.activated.add(r.id);let i={slug:t,installId:r.id,eventHandlers:[],consentHandlers:[],pushHandlers:[],sharedContextHandlers:[]};e.instances.push(i);let a={variables:r.variables,install:{id:r.id,label:r.label},getSession:async()=>{let n=await e.client.getSession();return e.target.config?.apps?.[t]?.geo===!0?n:{...n,ip:null,geo:null}},track:(t,n)=>{e.client.track(t,n).catch(y)},onEvent:e=>{i.eventHandlers.push(e)},onConsent:e=>{i.consentHandlers.push(e)},onPush:e=>{i.pushHandlers.push(e)},onSharedContext:n=>{if(e.target.config?.apps?.[t]?.sharedContext!==!0){console.error(`[Qinto] App "${t}" reads shared context without declaring the sharedContext capability.`);return}i.sharedContextHandlers.push(n),e.sharedContext!==null&&ae(e,t)&&T(i,[n],e.sharedContext)}};try{n(a)}catch(e){console.error(`[Qinto] App "${t}" failed to activate install "${r.id}".`,e)}},E=(e,t,n)=>{if(!x(e,t,e.consent))return;let r=((`_appInstalls`in e.target?e.target._appInstalls:void 0)?.[t]??[]).filter(t=>!e.activated.has(t.id));if(r.length===0)return;let i=n.factory;if(i===void 0){try{i=n.loader()}catch(e){i=null,console.error(`[Qinto] App "${t}" failed to load.`,e)}e.apps.set(t,{...n,factory:i})}if(i!==null)for(let n of r)ie(e,t,i,n)},ae=(e,t)=>x(e,t,e.consent)?e.sharedContextConsent===void 0||x(e,t,e.sharedContextConsent):!1,D=e=>{let{categories:t,apps:n}=e;if(typeof t==`object`&&t&&typeof n==`object`&&n)return{categories:t,apps:n}},O=(e,t)=>{let n=e;n.consent=t,n.sharedContextConsent=void 0;for(let n of e.instances)T(n,n.consentHandlers,t);e.onConsentSettled?.(t);for(let[t,n]of e.apps)E(e,t,n)},k=async e=>{try{O(e,await e.client.getConsent())}catch(e){console.error(`[Qinto] The apps consent read failed.`,e)}},A=e=>{let t;try{t=JSON.stringify(e)}catch{return}if(!(t===void 0||new TextEncoder().encode(t).length>ne))return JSON.parse(t)},j=e=>{let t={};for(let n of e){if(n.settled!==n.total||n.values.length!==1)continue;let e=A(n.values[0]);if(e===void 0)continue;let r={...t[n.instance.slug]??{},[n.instance.installId]:e},i={...t,[n.instance.slug]:r};new TextEncoder().encode(JSON.stringify(i)).length<=b&&(t[n.instance.slug]=r)}return Object.keys(t).length===0?void 0:t},M=async(e,t)=>{e.onPageEvent?.(e.consent);let n=[],r=[];for(let i of e.instances){if(!x(e,i.slug,e.consent))continue;if(e.target.config?.apps?.[i.slug]?.eventResults?.includes(t.type)!==!0){T(i,i.eventHandlers,t);continue}let a={instance:i,total:i.eventHandlers.length,settled:0,values:[]};n.push(a);for(let e of i.eventHandlers){let n;try{n=e(t)}catch(e){a.settled+=1,w(i,e);continue}r.push(Promise.resolve(n).then(e=>{a.settled+=1,e!==void 0&&a.values.push(e)},e=>{a.settled+=1,w(i,e)}))}}if(r.length>0){let e=y,t=new Promise(t=>{e=t}),n=setTimeout(e,te);await Promise.race([Promise.all(r),t]),clearTimeout(n)}return j(n)},N=e=>{let{client:t}=e;return{track:async(n,r,i)=>{let o=a(i?.eventId,r),s=t.actionContext(),c=await M(e,{type:`track`,event:n,eventId:o,properties:r??{}});return await t.submitTrack({event:n,eventId:o,properties:r,context:s,appResults:c}),{eventId:o}},identify:async(n,r)=>{let i=t.actionContext(),a=await M(e,{type:`identify`,event:`identify`,properties:n??{}});return t.submitIdentify({traits:n,id:r,context:i,appResults:a})},alias:t.alias,consent:async n=>{if(await t.submitConsent(n,t.actionContext()),e.onConsentMutation?.(),S(e.target)){let t=e;t.consent=null,await k(e)}},getAnonId:t.getAnonId,getConsent:t.getConsent,getSession:t.getSession,close:t.close}},P=(e,t)=>{let n=new Map,r=null,i=null,a=e=>{let[t,i]=e;if(n.has(t))return;let a={loader:i};n.set(t,a),r?.(t,a)},o=e,s=`_apps`in o?o._apps:void 0,c=Array.isArray(s)?s:[];c.push=(...e)=>{for(let t of e)a(t);return 0},o._apps=c;for(let e of c.splice(0))a(e);return{sharedContext:e=>{let{context:t}=e;if(typeof t!=`object`||!t||Array.isArray(t)){console.error(`[Qinto] The server sent a malformed shared context.`,e);return}let n=i;if(n===null)return;n.sharedContext=t;let r=D(e),a=r??n.consent;n.sharedContextConsent=r;for(let e of n.instances)x(n,e.slug,a)&&T(e,e.sharedContextHandlers,n.sharedContext)},push:e=>{let{app:t,install:n,topic:r,scope:a,to:o}=e,s=a===`site`;if(C(e,s)){console.error(`[Qinto] The server sent a malformed app push.`,e);return}let c=i;if(c===null)return;let l=s?new Set(o):null,u={topic:r,data:e.data,from:t};for(let e of c.instances)re(e,t,n,l)&&x(c,e.slug,c.consent)&&T(e,e.pushHandlers,u)},connect:async a=>{let o={target:e,client:a,apps:n,instances:[],activated:new Set,consent:null,sharedContext:i?.sharedContext??null,sharedContextConsent:i?.sharedContextConsent,onConsentSettled:t?.onConsentSettled,onConsentMutation:t?.onConsentMutation,onPageEvent:t?.onPageEvent};i=o,r=(e,t)=>{E(o,e,t),o.consent===null&&o.target.config?.consentConfiguration?.enabled===!0&&o.target.config?.apps?.[e]?.category!==`necessary`&&k(o)};for(let[e,t]of n)E(o,e,t);return e.config?.consentConfiguration?.enabled===!0&&S(e)?await k(o):o.onConsentSettled?.(o.consent),N(o)}}},F=512,I=864e5,L=e=>Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Object.fromEntries(Object.entries(t).map(([e,t])=>[e,t.value]))])),R=(e,t)=>`qinto:cap:${encodeURIComponent(e)}:${encodeURIComponent(t)}`,z=e=>{try{let t=window.sessionStorage.getItem(e);if(t===null)return null;let n=JSON.parse(t);return typeof n.at!=`number`||typeof n.anonId!=`string`||typeof n.apps!=`object`||n.apps===null||Date.now()-n.at>I?null:{at:n.at,anonId:n.anonId,apps:n.apps}}catch{return null}},B=(e,t)=>{try{window.sessionStorage.setItem(e,JSON.stringify(t))}catch{}},V=e=>{try{window.sessionStorage.removeItem(e)}catch{}},H=e=>{try{return decodeURIComponent(e)}catch{return e}},U=()=>{let e={};for(let t of document.cookie.split(`;`)){let n=t.indexOf(`=`);n>0&&(e[t.slice(0,n).trim()]=H(t.slice(n+1)))}return e},W=(e,t)=>{let n={};for(let r of e.queryParams){let e=t.params.get(r);e!==null&&e.length<=F&&(n[r]={value:e,source:`query`})}for(let r of e.cookies){let e=t.cookies[r];e!==void 0&&e.length<=F&&(n[r]={value:e,source:`cookie`})}return n},G=(e,t)=>{let n={params:new URLSearchParams(window.location.search),cookies:U()},r={};for(let[i,a]of Object.entries(e.config?.apps??{})){if(a.capture===void 0||!v(t,i,a.category))continue;let e=W(a.capture,n);Object.keys(e).length>0&&(r[i]=e)}return r},K=(e,t)=>{let n={};for(let[r,i]of Object.entries(e)){let e=t[r]??{},a={};for(let[t,n]of Object.entries(i))(e[t]?.value!==n.value||e[t]?.source!==n.source)&&(a[t]=n);Object.keys(a).length>0&&(n[r]=a)}return n},oe=(e,t,n,r)=>{let i=R(r,n),a=z(i),o=a?.apps??{},s=a?.anonId??null,c=a===null,l={},u=0,d=(e,t)=>{s!==null&&s!==e.anonId&&(o={}),s=e.anonId;let n=new Set(Object.entries(e.accepted).flatMap(([e,t])=>t.map(t=>`${e}\u0000${t}`)));for(let[e,r]of Object.entries(t))for(let[t,i]of Object.entries(r))n.has(`${e}\u0000${t}`)&&(o[e]={...o[e],[t]:i});B(i,{at:Date.now(),anonId:s,apps:o})},f=null,p=()=>{u+=1,o={},l={},V(i)},m=n=>{if(f=n,!c)return;let r=K(G(e,n),{...o,...l});if(Object.keys(r).length===0)return;let i=u;l={...l,...r},t(L(r)).then(e=>{i===u&&d(e,r)}).catch(()=>{}).finally(()=>{l={}})};return{settled:e=>{m(e)},needsAnon:()=>!c,observedAnon:e=>{(e===null||s!==null&&s!==e)&&p(),s=e,c=!0,m(f)},clear:p}},q=Symbol.for(`qinto.connectGate`),J=()=>{},se=e=>{let t=globalThis,n=(t[q]??Promise.resolve()).then(e);return t[q]=n.then(J,J),n},Y=class extends n{constructor(e){super(e),this.name=`QintoProtocolError`}},ce=e=>{if(typeof e!=`string`)return null;let t;try{t=JSON.parse(e)}catch{return null}if(typeof t!=`object`||!t)return null;let n=t;return n.t===`ack`||n.t===`error`||n.t===`consentState`||n.t===`session`||n.t===`captureAck`||n.t===`appPush`||n.t===`sharedContext`?t:null},le=e=>{if(e.t===`consentState`)return{categories:e.categories,apps:e.apps};if(e.t===`session`)return{anonId:e.anonId,globalId:e.globalId,ip:e.ip,geo:e.geo};if(e.t===`captureAck`)return{anonId:e.anonId,accepted:e.accepted}},ue=e=>{let t=new Map,n=e=>{let n=t.get(e);if(n!==void 0)return clearTimeout(n.timer),t.delete(e),n};return{submit:n=>new Promise((i,a)=>{let o={frame:n,sent:e.send(n),resolve:i,reject:a,timer:setTimeout(()=>{t.delete(n.ref),a(new r(`The Qinto request timed out.`))},e.requestTimeoutMs)};t.set(n.ref,o)}),flush:()=>{for(let n of t.values())n.sent||=e.send(n.frame)},deliver:e=>{let t=e.ref===void 0?void 0:n(e.ref);if(t!==void 0){if(e.t===`error`){t.reject(new Y(e.message));return}t.resolve(le(e))}},rejectAll:e=>{let n=[...t.values()];t.clear();for(let t of n)clearTimeout(t.timer),t.reject(e)}}},de=e=>new WebSocket(e),fe=500,pe=3e4,me=`session not initialized`,he=(e,t)=>{let n=Math.min(fe*2**e,pe);return Math.round(n/2+n/2*t)},ge=(e,t)=>e.t===`appPush`?(t.onAppPush?.(e),!0):e.t===`sharedContext`&&(t.onSharedContext?.(e),!0),X=e=>{let t=`${e.destination.replace(/\/+$/,``)}/open`,n=null,r=null,i=0,a=null,o=ue({send:e=>n===null||n.readyState!==1?!1:(n.send(JSON.stringify(e)),!0),requestTimeoutMs:e.requestTimeoutMs}),s=t=>{e.onError?.(t)},c=()=>{if(r!==null&&(clearTimeout(r),r=null),n!==null){let e=n;n=null,e.close()}o.rejectAll(new Y(`connection closed`))},l=()=>{let u=de(t);n=u,u.onopen=()=>{i=0;let e=a;a=null,o.flush(),e?.resolve()},u.onmessage=t=>{let n=ce(t.data);if(n===null){s(new Y(`invalid message`));return}ge(n,e)||(`anonId`in n&&typeof n.anonId==`string`&&e.onAnonId?.(n.anonId),o.deliver(n),n.t===`error`&&n.message===me&&u.close())},u.onerror=()=>{s(new Y(`connection closed`))},u.onclose=()=>{if(n!==u)return;n=null;let e=a;if(e!==null){a=null,c(),e.reject(new Y(`connection closed`));return}o.rejectAll(new Y(`connection closed`)),r=setTimeout(()=>{r=null,l()},he(i,Math.random())),i+=1}};return{connect:()=>new Promise((e,t)=>{a={resolve:e,reject:t},l()}),submit:e=>o.submit(e),close:()=>{c()}}},_e=1e4,ve=()=>{let e=0;return()=>(e+=1,`q${e}`)},ye=(e,t)=>{let n=`qinto:visit:${e.replace(/\/+$/,``)}:${t}`,r,i=!1;try{let e=sessionStorage.getItem(n),t=e===null?null:JSON.parse(e);t===null||typeof t.id!=`string`||!/^vis_[0-9a-f-]{36}$/.test(t.id)||!Number.isSafeInteger(t.startedAt)||t.startedAt<0?(r={id:`vis_${crypto.randomUUID()}`,startedAt:Date.now()},sessionStorage.setItem(n,JSON.stringify(r)),i=!0):r={id:t.id,startedAt:t.startedAt}}catch{r={id:`vis_${crypto.randomUUID()}`,startedAt:Date.now()},i=!0}return()=>{let e={...r,isNew:i};return i=!1,e}},be=(e,t,n,r)=>{let i=null,o=ye(n,r),s=()=>{let e=document.referrer;return{occurredAt:Date.now(),page:{url:window.location.href,...e===``?{}:{referrer:e}},session:o()}},c=async()=>{let n=await e.submit({t:`getSession`,ref:t()});return i=n.anonId,n};return{actionContext:s,submitIdentify:async({traits:n,id:r,context:i,appResults:a})=>{await e.submit({t:`identify`,ref:t(),traits:n,id:r,context:i,appResults:a})},submitTrack:async({event:n,eventId:r,properties:i,context:a,appResults:o})=>{await e.submit({t:`track`,ref:t(),event:n,eventId:r,properties:i,context:a,appResults:o})},submitConsent:async(n,r)=>{await e.submit({t:`consent`,ref:t(),categories:n.categories,apps:n.apps,context:r})},track:async(n,r,i)=>{let o=a(i?.eventId,r);return await e.submit({t:`track`,ref:t(),event:n,eventId:o,properties:r,context:s()}),{eventId:o}},alias:async n=>{await e.submit({t:`alias`,ref:t(),alias:n})},getConsent:async()=>await e.submit({t:`getConsent`,ref:t()}),getSession:c,getAnonId:async()=>(i===null&&await c(),i),close:async()=>{e.close()}}},xe=async e=>{let t=X({destination:e.destination,requestTimeoutMs:e.requestTimeoutMs??_e,onError:e.onError,onAppPush:e.onAppPush,onSharedContext:e.onSharedContext,onAnonId:e.onAnonId});await se(()=>t.connect());let n=ve();return{client:be(t,n,e.destination,e.globalName),submitCapture:async e=>await t.submit({t:`capture`,ref:n(),apps:e})}},Se=(e,t)=>{let n=null,r=P(e,{onConsentSettled:e=>{n?.settled(e)},onConsentMutation:()=>{n?.clear()},onPageEvent:e=>{n?.settled(e)}});return{connect:async i=>{let a=await xe({...i,globalName:t,onAppPush:r.push,onSharedContext:r.sharedContext,onAnonId:e=>{n?.observedAnon(e)}});n=oe(e,a.submitCapture,i.destination,t);let o=await r.connect(a.client);return n.needsAnon()&&n.observedAnon((await a.client.getSession()).anonId),o}}},Z=d(),Q=p(Z),$=`window.${Z}`;if(Q!==null&&Q.ready===void 0){let e=Se(Q,Z);t(Q),_(Q,async()=>{let t=Q.config?.destination;if(typeof t!=`string`||t===``)throw Error(`[Qinto] ${$}.config.destination is missing.`);return e.connect({destination:t})},$)}})();